andes[.]casa

This domain is flagged as a high-risk generic phishing threat targeting users of financial platforms, specifically impersonating Andes-related services. Analysis indicates the site is designed to harvest credentials or distribute malicious payloads under the guise of legitimate financial operations. The domain exhibits multiple indicators of compromise, including recent registration and lack of standard security measures. Infrastructure analysis reveals the domain andes.casa was registered on June 14, 2025, through Gname.com Pte. Ltd. and currently resolves to IP address 172.66.166.243, hosted on Cloudflare infrastructure (AS13335). Security vendor detection on VirusTotal stands at 1/95, with only one engine flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The site lacks an SSL certificate, a common red flag for phishing operations, and displays a page title of 'ANDES' without additional context or branding. Mitigation steps for this threat include immediate blocking of the domain andes.casa at the DNS or network perimeter level. Organizations should monitor for connections to 172.66.166.243 and alert on any internal traffic attempting to access this IP. End-users should be educated to verify financial service URLs, particularly those using newly registered domains or lacking HTTPS encryption. Security teams are advised to check logs for any prior interactions with this domain and investigate potential credential exposure or malware delivery associated with this phishing campaign.